EP1132801A2 - Access monitor and access monitoring method - Google Patents
Access monitor and access monitoring method Download PDFInfo
- Publication number
- EP1132801A2 EP1132801A2 EP01400619A EP01400619A EP1132801A2 EP 1132801 A2 EP1132801 A2 EP 1132801A2 EP 01400619 A EP01400619 A EP 01400619A EP 01400619 A EP01400619 A EP 01400619A EP 1132801 A2 EP1132801 A2 EP 1132801A2
- Authority
- EP
- European Patent Office
- Prior art keywords
- access
- cpu
- program
- memory
- detector
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
- G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
- G06F12/1483—Protection against unauthorised use of memory or access to memory by checking the subject access rights using an access-table, e.g. matrix or list
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
Definitions
- the present invention relates generally to security of an apparatus having a central processing unit (CPU) for executing a plurality of programs, and more particularly, to an access monitor for monitoring an unjust access between the programs in the apparatus, and an access monitoring method.
- CPU central processing unit
- an electronic dealing apparatus such as an electronic money terminal, an ATM (Automatic Teller Machine), or the like high in security is acquired.
- the electronic dealing apparatus installs a plurality of programs such as OS (Operating System), applications, various drivers, and the like, and an built-in CPU executes them.
- OS Operating System
- applications various drivers, and the like
- an built-in CPU executes them.
- the plurality of applications memorized in a RAM built in the apparatus are isolated from each other.
- the isolation of the applications is to prevent an unjust access to a memory region of another application in the RAM by execution of a certain application.
- Fig. 5 is a configuration diagram of a program installed in an apparatus.
- respective programs such as applications A, B, ... , drivers A, B, C, ... , or the like are managed by the OS.
- Fig. 6 is a typical diagram of program execution conditions.
- the plurality of programs to be executed are memorized in a memory (RAM) in the apparatus.
- the CPU accesses to a memory region corresponding to the program to be executed, and reads out the program to be executed.
- RAM memory
- the CPU accesses to a memory region corresponding to the program to be executed, and reads out the program to be executed.
- readout of another program is possible by execution of a certain program by rewriting of the certain program (arrow of a waved line in the drawing).
- an access violation of the program is monitored by the access monitor which is a hardware.
- the access monitor acquires a signal input from the CPU to a memory.
- the access monitor includes an access permission table as information of the memory region to be permitted to each program, and detects the access violation of the signal from the CPU by referring thereto. In this manner, the unjust access is monitored by the hardware, thereby preventing the unjust access by rewriting in software.
- the access monitor according to the present invention for attaining the aforesaid objects is, for example, one for monitoring an access between programs in an apparatus including a CPU and a memory storing each of the plurality of programs to be executed thereby.
- the access monitor comprises a table for storing access permission information including information concerning a region of the memory, which is permitted to access in each program; and a detector for acquiring a signal output from the CPU to the memory and for detecting an unjust access of a program executed by the CPU by monitoring the address included in the signal from the CPU based on the access permission information corresponding to the program executed by the CPU, the access permission information being established by a predetermined managing program in advance.
- the detector when the detector detects the unjust access, the detector causes the CPU to occur an interruption and the CPU executes an interruption processing by the managing program.
- the access monitor comprises a data storing unit, wherein, when the detector detects the unjust access, the detector writes information corresponding to the unjust access into the data storing unit, and the CPU executes the interruption processing corresponding to information written into the data storing unit.
- the program to be executed by the CPU writes an end of such program into the data storing unit, and when the detector detects that the end of the program is written into the data storing unit, the detector causes the CPU an interruption.
- the detector switches the established access permission information to the access permission information corresponding to the managing program in the case of occurring the interruption in the CPU.
- the managing program can access to all regions of the memory, and further the managing program is stored in the memory as rewriting disable, and the other programs other than the managing program are accessible to a storage region of the managing program.
- the access permission information has the information concerning read and/or write permission corresponding to the region of the memory, and when the detector detects the unjust access, the detector cut off a read signal and/or a write signal to be output from the CPU to the memory based on the access permission information.
- the access permission information has information concerning permission of instruction execution and/or data access corresponding to the region of the memory, and when the detector detects an unjust access, the detector cut off an instruction signal and/or data access signal to be output from the CPU to the memory based on the access permission information.
- the access monitoring method for attaining the aforesaid objects is, for example, one for monitoring an access between programs in an apparatus including a CPU and a memory storing each of the plurality of programs to be executed thereby.
- the access monitoring method comprises the steps of: preparing access permission information including information concerning a region of the memory, which is permitted to access in each program; establishing, by a predetermined managing program, the access permission information corresponding to the program to be executed by the CPU; acquiring an access signal to be output from the CPU to the memory; and detecting the unjust access of the program to be executed by the CPU by monitoring the region of the memory corresponding to the access signal from the CPU based on the established access permission information.
- Fig. 1 is a configuration diagram of an access monitor according to the embodiment of the present invention. According to the present invention, an unjust access to another program memorized in a memory region by execution of a certain program is detected by a hardware, namely an access monitor 1 in Fig. 1, thereby ensuring absolutely an isolation between the respective programs.
- a CPU 2 outputs various signals (an address signal AD, a data signal DT, a strobe signal (a read signal, a write signal, an instruction signal, a data access signal, or the like), STROBES, or the like) to a device group 3 which is accessed by a CPU 2 such as an inner memory, a register, an external device, or the like (hereinafter representatively referred to as a memory).
- the access monitor 1 monitors a signal output from the CPU 2.
- the access monitor 1 contains access monitoring information 11, an access violation detector 12, and access violation/end information 13.
- the access monitoring information 11 and access violation/end information 13 are stored in a register built in the access monitor 1, for example.
- the access monitoring information 11 contains presently executing application information 111, and an information table of an access permission region (hereinafter referred to as an access permission table) 112.
- the presently executing application information 111 contains an identification number for identifying each program, as described later.
- the access permission table 112 contains information of the access permission region corresponding to each application.
- the access violation detector 12 is constituted by a comparator or the like, and as described below, a signal to be output from the CPU 2 (an address signal, a strobe signal, or the like) is monitored based on the access monitoring information 11.
- access violation detector 12 detects an end of each program, or an access violation
- access violation information and program end information are written into the register (data storing unit) as the access violation/end information 13, and also an interruption (INT) is caused to the CPU 2.
- Fig. 2A and 2B are diagrams for explaining a configuration of a program installed in the access monitor according to the embodiment of the present invention.
- the monitor 1 according to the embodiment of the present invention further installs an application manager (managing program) as a program for managing the access monitoring information (the presently executing application information 111 and access permission table 112) 11, and the access violation/end information 13.
- the application manager manages a start and end of each application.
- an identifier of each program is allocated to each program.
- the identification number is defined as shown in Fig. 2B. Namely, OS, the application manager, a driver, a handler, etc. are allocated to the identification number "0".
- the identification number "0" is a special number, and in the program of the identification number "0", an access to all the regions in the inner memory 3 is permitted. Accordingly, in the above access permission table 112, the table corresponding to the identification number "0" is not necessary.
- Fig. 3 is a diagram for explaining a region of an inner memory according to the embodiment of the present invention.
- the region A is a region to which the program of the identification number "0" can access, and the OS, etc. is memorized.
- the region B is a region to which all the applications of the identification numbers "1" to “15” can access, and the application manager is memorized.
- the application manager rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "0" to an identification number of the application to be activated. At this time, as this rewriting is performed prior to transfer of a processing to the application to be activated, such inconveniences are caused that the rewriting is performed, and simultaneously the processing by the application manager of the identification number "0" is detected as the access violation.
- the application manager is stored in the region B where the programs of all the identification numbers are accessible. Namely, a rewriting routine of the identification number is effected in the region where all programs are accessible. Accordingly, the respective access permission tables 112 corresponding to the application of the identification numbers "1" to "15" have address information of the region B as well as the region (for example, regions D, E of Fig. 3) corresponding to each application. Furthermore, since it is prevented that the application manager is unjustly rewritten, the application manager is written into an inner ROM which is disabled to rewrite.
- the region C is, for example, a use region of a driver, a handler, etc., and the program of the identification number "0" is accessible. Furthermore, the regions D, E are use regions of applications 1, 2, respectively, and the programs of the respective identification numbers and the identification number "0" are accessible.
- Fig. 4 is a diagram showing a flowchart of an access control processing according to the embodiment of the present invention.
- a start and end of the application of the identification number "1" (hereinafter merely referred to as application 1) will be explained.
- an "activation request for the application 1" is issued from the OS to the application manager (S20). Then, the application manager rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "0" to "1" (S30). Thus, the access violation detector 12 selects the access permission table 112 corresponding to the application 1, and monitors various access signals from the CPU 2. When the application manager rewrites the presently executing application information 111, it calls out the application 1 (S31).
- the application 1 is activated (S50) (arrow 1 ⁇ of Fig. 3), and a processing of the application 1 is executed (S51).
- the execution of the application 1 is shown by arrow2 ⁇ of Fig. 3.
- S52 an interruption processing starts as explained next.
- the interruption processing is not limited to the use demand of the demand, but is executed even by an end of application in the case where the application 1 is merely desired to end.
- the application 1 writes interruption information into the access violation/end information 13 of the monitor 1 (S53).
- the interruption information contains an interruption factor (device use demand, application end, access violation, or the like).
- the access violation detector 12 also always monitors the access violation/end information 13. When the access violation detector 12 detects that the interruption information is written, it causes an interruption (INT) for the CPU 2, it further rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "1" to "0" (S40).
- the CPU 2 executes an interruption routine of an interruption table region in the region A of Fig. 3 (arrow 3 ⁇ of Fig. 3), and transfers the processing to the application manager (arrow 4 ⁇ of Fig. 3).
- the application manager analyzes the interruption information in the access violation/end information 13, and judges the interruption factor (S32).
- the application manager transfers the processing to the OS, the OS calls out the device (device call) (S21).
- the handler corresponding to the device activates (S10), and the access processing to the device is executed (S11).
- the handler is ended (S12)
- the processing is again transferred to the application manager by way of the OS.
- the application manager rewrites the presently executing application information 111 from the identification number "0" to "1" in the same manner as in steps S30 and S31, and calls out the application 1 (S34).
- the processing of the application 1 restarts (S54).
- the access violation detector 12 detects an access violation (unjust access) (S55). When the access violation detector 12 detects the access violation, it writes an access violation factor into the access violation/end information 13 as the interruption information, and also causes the interruption (INT) for the CPU 2.
- the access violation detector 12 includes an access control table in which a plurality of access violation factors are established, and determines the access violation factor corresponding to the access violation detected with reference thereto.
- the access violation detector 12 causes the interruption, and also similar to step S40, it rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "1" to "0" (S41). Similar to the above, when the interruption occurs, the CPU 2 executes the interruption routine of the interruption table region in the region A of Fig. 3 (arrow 5 ⁇ of Fig. 3), and transfers the processing to the application manager (arrow 4 ⁇ of Fig. 3).
- the application manager analyzes the access violation factor in the access violation/end information 13, and judges the interruption factor (S35). Corresponding to the type of access violation factor, the different processing may be established. For example, the application manager again rewrites the presently executing application information 111 from the identification number "0" to "1" (S36), and calls out the application 1 (S37). At this time, the application manager notifies the application 1 of an error. Thus, the application 1 is ended (S56). At this time, the application 1 writes the interruption information corresponding to the application end into the access violation/end information 13 of the monitor 1 (S57).
- the access violation detector 12 When the access violation detector 12 detects that the interruption information is written, it causes the interruption (INT) for the CPU 2, and further rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "1" to "0" (S42).
- the application manager analyzes the interruption factor (S38), and in the case where the interruption factor is an application end, as the application has already been ended, the processing returns to the OS (S23).
- the application is not ended during the application 1 corresponding to the interruption factor judged at step S35, but a processing of deleting a task of the application may be performed (KILL processing) (S22).
- the access monitor 1 monitors the access violation of the program in a hardware manner.
- the access monitor 1 includes an access permission table as the information of the memory region permitted in each program, and detects the access violation with reference thereto. Accordingly, it is possible to prevent the unjust access by rewriting of the program, etc.
- the application manager for controlling the access permission table in each program writes into the inner ROM, the rewriting of the application manager is impossible. Accordingly, the unjust access by the rewriting of the access permission table is prevented, and it is realized that the unjust access between the programs is absolutely ensured.
- the program establishing the access permission table is limited to the access to the inner memory, etc. by the access permission table.
- the interruption is automatically occurred in the CPU 2 by the access monitor 1 as a hardware.
- the processing of the CPU 2 is compulsorily transferred to the processing corresponding to the access violation by the application manager.
- the program establishing the access permission table utilizes the interruption for both the end and device use demand (device request).
- predetermined information is written to the register 13 of the access monitor 1, so that the access monitor 1 causes the CPU 2 to occur the interruption.
- the device use demand processing and program end processing by the application manager are executed. This is because, since a change of the presently executing program is recognized to the access monitor 1, it is necessary that the identification number in the presently executing program information 111 in the access monitor 1 is changed by the application manager.
- the region of the register for storing the access monitoring information 11 or access violation/end information 13 is designed to be a region where only the program of the identification number "0" (in particular, application manager) is accessible. This is because it is prevented that the application of another identification number rewrites unjustly its own identification number.
- the access monitor 1 monitors an address signal from the CPU 2 as well as a strobe signal (a read signal, a write signal, an instruction signal, a data access signal, etc.). Access conditions as well as the access permission region are established in the access permission table.
- the access conditions are, for example, a read enable/disable and a write enable/disable with respect to the predetermined memory region, the read and write being both the enable/disable.
- the access conditions are an enable/disable of an instruction execution and an enable/disable of a data access with respect to the predetermined memory region, and the instruction execution and data access are both the enable/disable.
- a gate 4 of a strobe line may be closed, thereby preventing the unjust access .
- the strobe line is cut off physically, and the strobe signal is not reached the inner memory 3, so that it is possible to prevent the unjust access.
- the access monitor 1 causes the CPU 2 to occur the interruption (of course, may cause to occur).
- the driver, handler, or the like is established as the same identification number "0" with the application manager, and OS, but a number excluding the identification number "0" may be imparted in the same manner as in the application.
- a different number from the application is imparted.
- the identification numbers of the application manager and OS are not required to be "0", but have only to differ from the identification number of the application.
- the device (memory, etc.) enables a high-speed data transfer not via the CPU by the DMA transfer. Namely, as the DMA transfer is made outside control of the CPU, in the DMA transfer, a signal from the CPU to the device is not output, and the access monitor according to the present invention cannot monitor the unjust access in the DMA transfer. According to this embodiment, in the case of the DMA transfer, the unjust access is monitored by a DMA control handler (control program) set to be an application level 0.
- a DMA control handler control program
- Fig. 7 shows a flowchart of an access control processing according to another embodiment of the present invention.
- the application manager In the case where the application X is activated, first, a "start request for application X" from the OS to the application manager is issued (S120). Then, the application manager rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "0" to "X" (S130). Thus, the access violation detector 12 selects the access permission table 112 corresponding to the application X, and monitors various access signals from the CPU 2. After the application manager rewrites the presently executing application information 111, it calls out the application X (S131).
- the application X is activated (S150), and during the processing of the application X, for example, data writing is effected into the access permission region of the application 1 of the memory 3 (S151), and when the DMA demand of the data is occurred (S152), and the interruption processing described in Fig. 4 starts.
- the application X writes into the access violation/end information 13 of the monitor 1 with a DMA request system call corresponding to the DMA demand as the interruption information (S153).
- the DMA request system call has parameters such as a transferor heading address, a transferee heading address, transfer data ranges, and the like.
- the application manager analyzes the interruption information in the access violation/end information 13, and judges the interruption factor (S132). According to this embodiment, as the interruption factor is a DMA demand, the application manager transfers the processing to the OS, and the OS activates the DMA control handler (S121).
- the activated DMA control handler refers to the access permission table 112 of the access violation monitor 1, and judges the unjust access in the parameters included in the DMA request system call (S110).
- the memory region up to the transferor heading address to such heading address + the transfer data ranges is a read permission region of the application X, and further whether or not (2) the memory region up to the transferor heading address to such heading address + the transfer data ranges is a write permission region of the application X.
- the OS receives an unjust access notice (S122), and further, the OS transfers the unjust access notice to the application manager, and transfers the processing to the application manager.
- the application manager rewrites the presently executing application information 111 from the identification number "0" to "X" (S133), and calls out the application X again (S134). At this time, the application manager notifies the application X of an error. Thus, the application X performs an end processing (S154). At this time, the application X writes an EXIT request system call corresponding to the application end into the access violation/end information 13 of the monitor 1, as the interruption information (S155). When the access violation detector 12 detects that the interruption information is written, it causes the interruption (INT) to the CPU 2, and further, rewrites the presently executing application information 111 of the access monitoring information 11 from the identification number "X" to "0" (S141). When the interruption occurs, as described above, the application manager analyzes the interruption factor (S135). According to this embodiment, as the interruption factor is an application end, the OS performs the application EXIT processing (S123), and transfers to a next task processing (S124).
- step S110 in the case where the access is unjust, the DMA control handler issues a DMA instruction (S111), and executes the DMA transfer.
- the OS receives a DMA completion notice (S125). Furthermore, the OS transfers the DMA completion notice to the application manager, and transfers the processing to the application manager.
- the application manager rewrites the presently executing application information 111 from the identification number "0" to "X" (S136), and calls out the application X again (S137). Thus, the processing of the application X is continued (S156).
- the DMA control handler checks the access region with respect to the DMA demand of the activating application, and detects the unjust access.
- the apparatus including the CPU and the plurality of programs to be executed thereby, it is possible to prevent the unjust access between the programs, so that security of the apparatus is enhanced.
Abstract
Description
- The present invention relates generally to security of an apparatus having a central processing unit (CPU) for executing a plurality of programs, and more particularly, to an access monitor for monitoring an unjust access between the programs in the apparatus, and an access monitoring method.
- In recent years, as an electronic commerce, etc. is spread, an electronic dealing apparatus such as an electronic money terminal, an ATM (Automatic Teller Machine), or the like high in security is acquired. The electronic dealing apparatus installs a plurality of programs such as OS (Operating System), applications, various drivers, and the like, and an built-in CPU executes them. At this time, in order to secure the security of each application, it is necessary that the plurality of applications memorized in a RAM built in the apparatus are isolated from each other. The isolation of the applications is to prevent an unjust access to a memory region of another application in the RAM by execution of a certain application.
- Fig. 5 is a configuration diagram of a program installed in an apparatus. In Fig. 5, respective programs such as applications A, B, ... , drivers A, B, C, ... , or the like are managed by the OS.
- Fig. 6 is a typical diagram of program execution conditions. The plurality of programs to be executed are memorized in a memory (RAM) in the apparatus. The CPU accesses to a memory region corresponding to the program to be executed, and reads out the program to be executed. However, in the prior art, as each program is isolated in software, readout of another program is possible by execution of a certain program by rewriting of the certain program (arrow of a waved line in the drawing).
- More specifically, as each program operates only one program time-divisionally, it is impossible to completely control operation of a program such as applications, or the like by the OS. Accordingly, in order that a programmer looks at a memory region of another program intentionally, when the programmer rewrites the program, or a runaway of the executing program occurs, it is possible that an unjust access is readily made to a memory region of another program.
- In this manner, in a conventional apparatus, in the case where security information (for example, a password, etc.) is memorized in a memory region by executing a program, an access can be made from the other programs to the memory region, and there is a problem that, if the program is isolated only in software, an absolute isolation between programs is not ensured.
- Furthermore, even if a certain program is installed in the apparatus, and the operation is confirmed, when another program is installed therein thereafter, it is impossible to ensure whether to affect the original program, or whether or not the original program operates correctly. Accordingly, after another program is installed therein, operational verification of the original program had to be remade from the beginning.
- It is therefore an object of the present invention to provide an access monitor for monitoring an unjust access between programs in an apparatus installing a plurality of programs, and an access monitoring method.
- In order to attain the above objects, according to the present invention, an access violation of the program is monitored by the access monitor which is a hardware. The access monitor acquires a signal input from the CPU to a memory. The access monitor includes an access permission table as information of the memory region to be permitted to each program, and detects the access violation of the signal from the CPU by referring thereto. In this manner, the unjust access is monitored by the hardware, thereby preventing the unjust access by rewriting in software.
- The access monitor according to the present invention for attaining the aforesaid objects is, for example, one for monitoring an access between programs in an apparatus including a CPU and a memory storing each of the plurality of programs to be executed thereby. The access monitor comprises a table for storing access permission information including information concerning a region of the memory, which is permitted to access in each program; and a detector for acquiring a signal output from the CPU to the memory and for detecting an unjust access of a program executed by the CPU by monitoring the address included in the signal from the CPU based on the access permission information corresponding to the program executed by the CPU, the access permission information being established by a predetermined managing program in advance.
- Preferably, when the detector detects the unjust access, the detector causes the CPU to occur an interruption and the CPU executes an interruption processing by the managing program.
- Furthermore, the access monitor comprises a data storing unit, wherein, when the detector detects the unjust access, the detector writes information corresponding to the unjust access into the data storing unit, and the CPU executes the interruption processing corresponding to information written into the data storing unit.
- Furthermore, preferably, the program to be executed by the CPU writes an end of such program into the data storing unit, and when the detector detects that the end of the program is written into the data storing unit, the detector causes the CPU an interruption.
- Furthermore, the detector switches the established access permission information to the access permission information corresponding to the managing program in the case of occurring the interruption in the CPU.
- The managing program can access to all regions of the memory, and further the managing program is stored in the memory as rewriting disable, and the other programs other than the managing program are accessible to a storage region of the managing program.
- Furthermore, preferably, the access permission information has the information concerning read and/or write permission corresponding to the region of the memory, and when the detector detects the unjust access, the detector cut off a read signal and/or a write signal to be output from the CPU to the memory based on the access permission information.
- Furthermore, preferably, the access permission information has information concerning permission of instruction execution and/or data access corresponding to the region of the memory, and when the detector detects an unjust access, the detector cut off an instruction signal and/or data access signal to be output from the CPU to the memory based on the access permission information.
- The access monitoring method for attaining the aforesaid objects is, for example, one for monitoring an access between programs in an apparatus including a CPU and a memory storing each of the plurality of programs to be executed thereby. The access monitoring method comprises the steps of: preparing access permission information including information concerning a region of the memory, which is permitted to access in each program; establishing, by a predetermined managing program, the access permission information corresponding to the program to be executed by the CPU; acquiring an access signal to be output from the CPU to the memory; and detecting the unjust access of the program to be executed by the CPU by monitoring the region of the memory corresponding to the access signal from the CPU based on the established access permission information.
-
- Fig. 1 shows a configuration of a monitor according to an embodiment of the present invention;
- Fig. 2A and 2B are diagrams for explaining a configuration of a program installed in a monitor according to the embodiment of the present invention;
- Fig. 3 is a diagram for explaining a region of an inner memory according to the embodiment of the present invention;
- Fig. 4 is a diagram showing a flowchart of an access control processing according to the embodiment of the present invention;
- Fig. 5 shows a configuration of a conventional program installed in an apparatus;
- Fig. 6 is a typical diagram of program execution conditions; and
- Fig. 7 is a flowchart of the access control processing according to another embodiment of the present invention.
-
- Hereinafter, an embodiment of the present invention will be explained. However, a technical scope of the present invention is not limited to this embodiment.
- Fig. 1 is a configuration diagram of an access monitor according to the embodiment of the present invention. According to the present invention, an unjust access to another program memorized in a memory region by execution of a certain program is detected by a hardware, namely an
access monitor 1 in Fig. 1, thereby ensuring absolutely an isolation between the respective programs. - In Fig. 1, a
CPU 2 outputs various signals (an address signal AD, a data signal DT, a strobe signal (a read signal, a write signal, an instruction signal, a data access signal, or the like), STROBES, or the like) to adevice group 3 which is accessed by aCPU 2 such as an inner memory, a register, an external device, or the like (hereinafter representatively referred to as a memory). The access monitor 1 monitors a signal output from theCPU 2. - The
access monitor 1 containsaccess monitoring information 11, anaccess violation detector 12, and access violation/end information 13. Theaccess monitoring information 11 and access violation/end information 13 are stored in a register built in theaccess monitor 1, for example. Furthermore, theaccess monitoring information 11 contains presently executingapplication information 111, and an information table of an access permission region (hereinafter referred to as an access permission table) 112. The presently executingapplication information 111 contains an identification number for identifying each program, as described later. The access permission table 112 contains information of the access permission region corresponding to each application. Theaccess violation detector 12 is constituted by a comparator or the like, and as described below, a signal to be output from the CPU 2 (an address signal, a strobe signal, or the like) is monitored based on theaccess monitoring information 11. - Furthermore, when the
access violation detector 12 detects an end of each program, or an access violation, access violation information and program end information are written into the register (data storing unit) as the access violation/end information 13, and also an interruption (INT) is caused to theCPU 2. - Fig. 2A and 2B are diagrams for explaining a configuration of a program installed in the access monitor according to the embodiment of the present invention. In Fig. 2A, the
monitor 1 according to the embodiment of the present invention further installs an application manager (managing program) as a program for managing the access monitoring information (the presently executingapplication information 111 and access permission table 112) 11, and the access violation/end information 13. Furthermore, the application manager manages a start and end of each application. - Furthermore, according to the embodiment of the present invention, an identifier of each program is allocated to each program. For example, in the case where numbers of "0" to "15" (identification numbers) are allocated as the identifier, the identification number is defined as shown in Fig. 2B. Namely, OS, the application manager, a driver, a handler, etc. are allocated to the identification number "0". The identification number "0" is a special number, and in the program of the identification number "0", an access to all the regions in the
inner memory 3 is permitted. Accordingly, in the above access permission table 112, the table corresponding to the identification number "0" is not necessary. - Furthermore, separate application is allocated to the identification numbers "1" to "15" excluding the identification number "0." In the application of the identification numbers "1" to "15," an access is permitted only to the region of the
inner memory 3 specified by the access permission table 112. In the case where the program of the identification numbers "1" to "15" accesses to the region not specified by the access permission table 112, theaccess violation detector 2 detects the access violation. - Fig. 3 is a diagram for explaining a region of an inner memory according to the embodiment of the present invention. In regions A to E shown in Fig. 3, the region A is a region to which the program of the identification number "0" can access, and the OS, etc. is memorized. The region B is a region to which all the applications of the identification numbers "1" to "15" can access, and the application manager is memorized. In the case where the programs of the identification numbers "1" to "15" are activated, as described below, the application manager rewrites the presently executing
application information 111 of theaccess monitoring information 11 from the identification number "0" to an identification number of the application to be activated. At this time, as this rewriting is performed prior to transfer of a processing to the application to be activated, such inconveniences are caused that the rewriting is performed, and simultaneously the processing by the application manager of the identification number "0" is detected as the access violation. - In order to dissolve these inconveniences, according to the embodiment of the present invention, as shown in Fig. 3, the application manager is stored in the region B where the programs of all the identification numbers are accessible. Namely, a rewriting routine of the identification number is effected in the region where all programs are accessible. Accordingly, the respective access permission tables 112 corresponding to the application of the identification numbers "1" to "15" have address information of the region B as well as the region (for example, regions D, E of Fig. 3) corresponding to each application. Furthermore, since it is prevented that the application manager is unjustly rewritten, the application manager is written into an inner ROM which is disabled to rewrite.
- The region C is, for example, a use region of a driver, a handler, etc., and the program of the identification number "0" is accessible. Furthermore, the regions D, E are use regions of
applications - Fig. 4 is a diagram showing a flowchart of an access control processing according to the embodiment of the present invention. In Fig. 4, for example, a start and end of the application of the identification number "1" (hereinafter merely referred to as application 1) will be explained.
- In the case where the
application 1 is activated, first, an "activation request for theapplication 1" is issued from the OS to the application manager (S20). Then, the application manager rewrites the presently executingapplication information 111 of theaccess monitoring information 11 from the identification number "0" to "1" (S30). Thus, theaccess violation detector 12 selects the access permission table 112 corresponding to theapplication 1, and monitors various access signals from theCPU 2. When the application manager rewrites the presently executingapplication information 111, it calls out the application 1 (S31). - The
application 1 is activated (S50) (arrow 1 ○ of Fig. 3), and a processing of theapplication 1 is executed (S51). The execution of theapplication 1 is shown by arrow2 ○ of Fig. 3. During the processing of theapplication 1, for example, when a use demand of the device occurs (S52), an interruption processing starts as explained next. The interruption processing is not limited to the use demand of the demand, but is executed even by an end of application in the case where theapplication 1 is merely desired to end. - In the case where the interruption processing is executed by the use demand of the device or application end, the
application 1 writes interruption information into the access violation/end information 13 of the monitor 1 (S53). The interruption information contains an interruption factor (device use demand, application end, access violation, or the like). Theaccess violation detector 12 also always monitors the access violation/end information 13. When theaccess violation detector 12 detects that the interruption information is written, it causes an interruption (INT) for theCPU 2, it further rewrites the presently executingapplication information 111 of theaccess monitoring information 11 from the identification number "1" to "0" (S40). When the interruption occurs, theCPU 2 executes an interruption routine of an interruption table region in the region A of Fig. 3 (arrow 3 ○ of Fig. 3), and transfers the processing to the application manager (arrow 4 ○ of Fig. 3). - The application manager analyzes the interruption information in the access violation/
end information 13, and judges the interruption factor (S32). In the case where the interruption factor is a use demand of the device, the application manager transfers the processing to the OS, the OS calls out the device (device call) (S21). Then, for example, the handler corresponding to the device activates (S10), and the access processing to the device is executed (S11). Thereafter, when the handler is ended (S12), the processing is again transferred to the application manager by way of the OS. The application manager rewrites the presently executingapplication information 111 from the identification number "0" to "1" in the same manner as in steps S30 and S31, and calls out the application 1 (S34). Thus, the processing of theapplication 1 restarts (S54). - When the access signal to the memory region which is not permitted by the access permission table 112 corresponding to the
application 1 is output during the processing of theapplication 1, theaccess violation detector 12 detects an access violation (unjust access) (S55). When theaccess violation detector 12 detects the access violation, it writes an access violation factor into the access violation/end information 13 as the interruption information, and also causes the interruption (INT) for theCPU 2. Incidentally, theaccess violation detector 12 includes an access control table in which a plurality of access violation factors are established, and determines the access violation factor corresponding to the access violation detected with reference thereto. - Furthermore, the
access violation detector 12 causes the interruption, and also similar to step S40, it rewrites the presently executingapplication information 111 of theaccess monitoring information 11 from the identification number "1" to "0" (S41). Similar to the above, when the interruption occurs, theCPU 2 executes the interruption routine of the interruption table region in the region A of Fig. 3 (arrow 5 ○ of Fig. 3), and transfers the processing to the application manager (arrow 4 ○ of Fig. 3). - The application manager analyzes the access violation factor in the access violation/
end information 13, and judges the interruption factor (S35). Corresponding to the type of access violation factor, the different processing may be established. For example, the application manager again rewrites the presently executingapplication information 111 from the identification number "0" to "1" (S36), and calls out the application 1 (S37). At this time, the application manager notifies theapplication 1 of an error. Thus, theapplication 1 is ended (S56). At this time, theapplication 1 writes the interruption information corresponding to the application end into the access violation/end information 13 of the monitor 1 (S57). When theaccess violation detector 12 detects that the interruption information is written, it causes the interruption (INT) for theCPU 2, and further rewrites the presently executingapplication information 111 of theaccess monitoring information 11 from the identification number "1" to "0" (S42). When the interruption occurs, in the same manner as above, the application manager analyzes the interruption factor (S38), and in the case where the interruption factor is an application end, as the application has already been ended, the processing returns to the OS (S23). - Incidentally, the application is not ended during the
application 1 corresponding to the interruption factor judged at step S35, but a processing of deleting a task of the application may be performed (KILL processing) (S22). - In this manner, according to the embodiment of the present invention, the access monitor 1 monitors the access violation of the program in a hardware manner. The access monitor 1 includes an access permission table as the information of the memory region permitted in each program, and detects the access violation with reference thereto. Accordingly, it is possible to prevent the unjust access by rewriting of the program, etc.
- Furthermore, as the application manager for controlling the access permission table in each program writes into the inner ROM, the rewriting of the application manager is impossible. Accordingly, the unjust access by the rewriting of the access permission table is prevented, and it is realized that the unjust access between the programs is absolutely ensured.
- The program establishing the access permission table is limited to the access to the inner memory, etc. by the access permission table. When the access violating the access permission table is tried, the interruption is automatically occurred in the
CPU 2 by the access monitor 1 as a hardware. The processing of theCPU 2 is compulsorily transferred to the processing corresponding to the access violation by the application manager. - On the other hand, the program establishing the access permission table utilizes the interruption for both the end and device use demand (device request). As described above, at the times of the device use demand and program end, predetermined information is written to the
register 13 of theaccess monitor 1, so that the access monitor 1 causes theCPU 2 to occur the interruption. By this interruption processing, the device use demand processing and program end processing by the application manager are executed. This is because, since a change of the presently executing program is recognized to theaccess monitor 1, it is necessary that the identification number in the presently executingprogram information 111 in the access monitor 1 is changed by the application manager. - Furthermore, the region of the register for storing the
access monitoring information 11 or access violation/end information 13 is designed to be a region where only the program of the identification number "0" (in particular, application manager) is accessible. This is because it is prevented that the application of another identification number rewrites unjustly its own identification number. - Furthermore, according to the present invention, as shown in Fig. 1, the access monitor 1 monitors an address signal from the
CPU 2 as well as a strobe signal (a read signal, a write signal, an instruction signal, a data access signal, etc.). Access conditions as well as the access permission region are established in the access permission table. The access conditions are, for example, a read enable/disable and a write enable/disable with respect to the predetermined memory region, the read and write being both the enable/disable. Furthermore, the access conditions are an enable/disable of an instruction execution and an enable/disable of a data access with respect to the predetermined memory region, and the instruction execution and data access are both the enable/disable. - In the case where the access monitor 1 violates the access conditions of the access permission table 112, a gate 4 of a strobe line may be closed, thereby preventing the unjust access . In this manner, the strobe line is cut off physically, and the strobe signal is not reached the
inner memory 3, so that it is possible to prevent the unjust access. Incidentally, in this case, it is not necessary that the access monitor 1 causes theCPU 2 to occur the interruption (of course, may cause to occur). - Furthermore, according to the above embodiment, the driver, handler, or the like is established as the same identification number "0" with the application manager, and OS, but a number excluding the identification number "0" may be imparted in the same manner as in the application. However, as the direct operation by the application is not permitted, a different number from the application is imparted. Furthermore, the identification numbers of the application manager and OS are not required to be "0", but have only to differ from the identification number of the application.
- Next, another embodiment of the present invention will be explained. According to this embodiment, a processing in the case where the application occurs a DMA (Direct Memory Access) demand will be explained. The device (memory, etc.) enables a high-speed data transfer not via the CPU by the DMA transfer. Namely, as the DMA transfer is made outside control of the CPU, in the DMA transfer, a signal from the CPU to the device is not output, and the access monitor according to the present invention cannot monitor the unjust access in the DMA transfer. According to this embodiment, in the case of the DMA transfer, the unjust access is monitored by a DMA control handler (control program) set to be an
application level 0. - Fig. 7 shows a flowchart of an access control processing according to another embodiment of the present invention. In Fig. 7, a start and end of the application of an identification number "X (X=1 to 15)" (hereinafter referred to as merely application X) will be explained.
- In the case where the application X is activated, first, a "start request for application X" from the OS to the application manager is issued (S120). Then, the application manager rewrites the presently executing
application information 111 of theaccess monitoring information 11 from the identification number "0" to "X" (S130). Thus, theaccess violation detector 12 selects the access permission table 112 corresponding to the application X, and monitors various access signals from theCPU 2. After the application manager rewrites the presently executingapplication information 111, it calls out the application X (S131). - The application X is activated (S150), and during the processing of the application X, for example, data writing is effected into the access permission region of the
application 1 of the memory 3 (S151), and when the DMA demand of the data is occurred (S152), and the interruption processing described in Fig. 4 starts. - That is, the application X writes into the access violation/
end information 13 of themonitor 1 with a DMA request system call corresponding to the DMA demand as the interruption information (S153). The DMA request system call has parameters such as a transferor heading address, a transferee heading address, transfer data ranges, and the like. When theaccess violation detector 12 detects that the interruption information is written, it causes the interruption (INT) to theCPU 2, and further, rewrites the presently executingapplication information 111 of theaccess monitoring information 11 from the identification number "X" to "0" (S140). When the interruption occurs, as described above, theCPU 2 transfers the processing to the application manager. - The application manager analyzes the interruption information in the access violation/
end information 13, and judges the interruption factor (S132). According to this embodiment, as the interruption factor is a DMA demand, the application manager transfers the processing to the OS, and the OS activates the DMA control handler (S121). The activated DMA control handler refers to the access permission table 112 of theaccess violation monitor 1, and judges the unjust access in the parameters included in the DMA request system call (S110). Specifically, in the parameters included in the DMA request system call, it is judged whether or not
(1) the memory region up to the transferor heading address to such heading address + the transfer data ranges is a read permission region of the application X, and further whether or not
(2) the memory region up to the transferor heading address to such heading address + the transfer data ranges is a write permission region of the application X. - When the DMA control handler judges as the unjust access, the OS receives an unjust access notice (S122), and further, the OS transfers the unjust access notice to the application manager, and transfers the processing to the application manager.
- The application manager rewrites the presently executing
application information 111 from the identification number "0" to "X" (S133), and calls out the application X again (S134). At this time, the application manager notifies the application X of an error. Thus, the application X performs an end processing (S154). At this time, the application X writes an EXIT request system call corresponding to the application end into the access violation/end information 13 of themonitor 1, as the interruption information (S155). When theaccess violation detector 12 detects that the interruption information is written, it causes the interruption (INT) to theCPU 2, and further, rewrites the presently executingapplication information 111 of theaccess monitoring information 11 from the identification number "X" to "0" (S141). When the interruption occurs, as described above, the application manager analyzes the interruption factor (S135). According to this embodiment, as the interruption factor is an application end, the OS performs the application EXIT processing (S123), and transfers to a next task processing (S124). - On the other hand, at step S110, in the case where the access is unjust, the DMA control handler issues a DMA instruction (S111), and executes the DMA transfer. When the DMA transfer is ended, the OS receives a DMA completion notice (S125). Furthermore, the OS transfers the DMA completion notice to the application manager, and transfers the processing to the application manager.
- The application manager rewrites the presently executing
application information 111 from the identification number "0" to "X" (S136), and calls out the application X again (S137). Thus, the processing of the application X is continued (S156). - In this manner, in the case where the DMA demand occurs in the application, the DMA control handler checks the access region with respect to the DMA demand of the activating application, and detects the unjust access.
- Hereinabove, according to the present invention, in the apparatus including the CPU and the plurality of programs to be executed thereby, it is possible to prevent the unjust access between the programs, so that security of the apparatus is enhanced.
- The scope of protection of the present invention is not limited to the above embodiments but covers the invention defined by the appended claims and its equivalents.
Claims (17)
- An access monitor (1) for monitoring an access between programs in an apparatus including a CPU (2) and a memory (3) memorizing a plurality of programs to be executed thereby, comprising:a table (112) for storing access permission information including information concerning a region of the memory (3), which is permitted to access in each program; anda detector (12) for acquiring a signal output from the CPU (2) to the memory and for detecting an unjust access of a program executed by the CPU (2) by monitoring the address included in the signal from the CPU (2) based on the access permission information corresponding to the program executed by the CPU (2), the access permission information being established by a predetermined managing program in advance.
- The access monitor (1) according to claim 1, wherein, when the detector (12) detects the unjust access, the detector (12) causes the CPU (2) to occur an interruption and the CPU (2) executes an interruption processing by the managing program.
- The access monitor (1) according to claim 2, further comprising:a data storing unit,wherein, when the detector (12) detects the unjust access, the detector (12) writes information corresponding to the unjust access into the data storing unit, and the CPU (2) executes the interruption processing corresponding to information written into the data storing unit.
- The access monitor (1) according to claim 3, wherein the program to be executed by the CPU (2) writes an end of such program into the data storing unit, and when the detector (12) detects that the end of the program is written into the data storing unit, the detector (12) causes the CPU (2) an interruption.
- The access monitor (1) according to claim 2, wherein the detector (12) switches the established access permission information to the access permission information corresponding to the managing program in the case of occurring the interruption in the CPU (2).
- The access monitor (1) according to claim 1, wherein the managing program is able to access to all regions of the memory (3).
- The access monitor (1) according to claim 1, wherein the managing program is stored in the memory (3) as rewriting disable, and the other programs other than the managing program are accessible to a storage region of the managing program.
- The access monitor (1) according to claim 1, wherein the access permission information has the information concerning read and/or write permission corresponding to the region of the memory (3), and when the detector (12) detects the unjust access, the detector (12) cuts off a read signal and/or or a write signal to be output from the CPU (2) to the memory (3) based on the access permission information.
- The access monitor (1) according to claim 1, wherein the access permission information has information concerning permission of instruction execution and/or data access corresponding to the region of the memory (3), and when the detector (12) detects an unjust access, the detector (12) cuts off an instruction signal and/or data access signal to be output from the CPU to the memory (3) based on the access permission information.
- An access monitoring method for monitoring an access between programs in an apparatus including a CPU (2) and a memory (3) storing a plurality of programs to be executed thereby, comprising the steps of:preparing access permission information including information concerning a region of the memory (3), which is permitted to access in each program;establishing, by a predetermined managing program, the access permission information corresponding to the program to be executed by the CPU (2);acquiring an access signal to be output from the CPU (2) to the memory (3); anddetecting the unjust access of the program to be executed by the CPU (2) by monitoring the region of the memory (3) corresponding to the access signal from the CPU (2) based on the established access permission information.
- The access monitoring method according to claim 10, wherein the detector (12) causes the CPU (2) to occur an interruption and an interruption processing by the managing program is executed by the CPU (2) when the unjust access is detected.
- The access monitoring method according to claim 11, wherein the detector (12) switches the established access permission information to the access permission information corresponding to the managing program when unjust access is detected.
- The access monitoring method according to claim 10, wherein the managing program is able to access to all regions of the memory (3).
- The access monitoring method according to claim 10, wherein the managing program is stored in the memory (3) as rewriting disable, and the other programs other than the managing program are accessible to a storage region of the managing program.
- The access monitoring method according to claim 10, wherein the access permission information has the information concerning read and/or write permission corresponding to the region of the memory (3), and when the detector (12) detects the unjust access, the detector (12) cuts off a read signal and/or a write signal to be output from the CPU (2) to the memory (3) based on the access permission information.
- The access monitoring method according to claim 10, wherein the access permission information has information concerning permission of instruction execution and/or data access corresponding to the region of the memory (3), and when the detector (12) detects an unjust access, the detector (12) cuts off an instruction signal and/or data access signal to be output from the CPU (2) to the memory (3) based on the access permission information.
- The access monitoring method according to claim 10, wherein, when the program executed by the CPU (2) occurs a direct memory access request, a program controlling the direct memory (3) access monitors the region of the memory corresponding to the direct access memory request and detects the unjust access of the program executed by the CPU (2) based on the established access permission table.
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2000066885 | 2000-03-10 | ||
JP2000066885 | 2000-03-10 | ||
JP2000196621 | 2000-06-29 | ||
JP2000196621A JP4522548B2 (en) | 2000-03-10 | 2000-06-29 | Access monitoring device and access monitoring method |
Publications (2)
Publication Number | Publication Date |
---|---|
EP1132801A2 true EP1132801A2 (en) | 2001-09-12 |
EP1132801A3 EP1132801A3 (en) | 2005-06-29 |
Family
ID=26587205
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP01400619A Withdrawn EP1132801A3 (en) | 2000-03-10 | 2001-03-09 | Access monitor and access monitoring method |
Country Status (3)
Country | Link |
---|---|
US (1) | US7039779B2 (en) |
EP (1) | EP1132801A3 (en) |
JP (1) | JP4522548B2 (en) |
Cited By (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1311134A2 (en) * | 2001-11-08 | 2003-05-14 | Nec Corporation | Program executing method in service system and program executing apparatus for the same |
WO2004090731A2 (en) * | 2003-04-04 | 2004-10-21 | Infineon Technologies Ag | Program-controlled unit |
EP1764721A2 (en) * | 2005-09-15 | 2007-03-21 | NTT DoCoMo INC. | Apparatus and method for controlling access to an external memory |
FR2897175A1 (en) * | 2006-02-09 | 2007-08-10 | Atmel Corp | Computer system`s resource e.g. register, access detecting module, has detection circuit that detects inappropriate access to computer system during processing activity, and trigger coupled to detection circuit |
GB2441216A (en) * | 2006-08-21 | 2008-02-27 | Chris J Newburn | Monitoring accesses to a region of memory |
EP1939753A1 (en) * | 2006-12-20 | 2008-07-02 | St Microelectronics S.A. | Protection of memory zones |
EP1942417A1 (en) * | 2006-12-20 | 2008-07-09 | St Microelectronics S.A. | Circuit for protection of memory zones |
DE10297687B4 (en) * | 2002-03-27 | 2008-11-13 | Advanced Micro Devices, Inc., Sunnyvale | A processor with partitioned security input / output permission bit structures and methods for selectively executing an input / output instruction |
WO2009018483A1 (en) * | 2007-07-31 | 2009-02-05 | Viasat, Inc. | Input output access controller |
EP2851804A1 (en) * | 2013-09-20 | 2015-03-25 | Fujitsu Limited | Arithmetic processing device, information processing device, control method for information processing device, and control program for information processing device |
Families Citing this family (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
KR100525537B1 (en) * | 2000-12-28 | 2005-11-02 | 엘지전자 주식회사 | Applied Program Bungle Detection Apparatus and Method by Interrupt |
US20040064723A1 (en) * | 2001-10-31 | 2004-04-01 | Barnes Brian C. | Method and apparatus for physical address-based security to determine target security |
US7698522B1 (en) | 2002-01-11 | 2010-04-13 | Global Foundries | Method and apparatus for linear address based page level security scheme to determine current security context |
US7739498B2 (en) * | 2002-01-15 | 2010-06-15 | GlobalFoundries, Inc. | Method and apparatus for multi-table accessing of input/output devices using target security |
AU2003901454A0 (en) * | 2003-03-28 | 2003-04-10 | Secure Systems Limited | Security system and method for computer operating systems |
DE10315638A1 (en) * | 2003-04-04 | 2004-10-28 | Infineon Technologies Ag | Program controlled unit |
DE10315727A1 (en) * | 2003-04-04 | 2004-10-28 | Infineon Technologies Ag | Program controlled unit |
DE10315726A1 (en) * | 2003-04-04 | 2004-11-04 | Infineon Technologies Ag | Program controlled unit |
US20050144408A1 (en) * | 2003-12-24 | 2005-06-30 | Kenji Ejima | Memory protection unit, memory protection method, and computer-readable record medium in which memory protection program is recorded |
JP4563707B2 (en) * | 2004-03-25 | 2010-10-13 | ルネサスエレクトロニクス株式会社 | Memory protector |
JP4717381B2 (en) | 2004-06-11 | 2011-07-06 | 株式会社エヌ・ティ・ティ・ドコモ | Mobile device and access control method |
JP5069406B2 (en) * | 2004-07-23 | 2012-11-07 | テキサス インスツルメンツ インコーポレイテッド | System and method for identifying and preventing security breaches in computer systems |
US7802110B2 (en) * | 2004-08-25 | 2010-09-21 | Microsoft Corporation | System and method for secure execution of program code |
US7457926B2 (en) | 2005-05-18 | 2008-11-25 | International Business Machines Corporation | Cache line replacement monitoring and profiling |
JP4698285B2 (en) | 2005-05-19 | 2011-06-08 | 富士通株式会社 | Information processing apparatus, information processing method, and computer program |
US20060294596A1 (en) * | 2005-06-27 | 2006-12-28 | Priya Govindarajan | Methods, systems, and apparatus to detect unauthorized resource accesses |
US8434127B2 (en) | 2007-02-08 | 2013-04-30 | Nec Corporation | Access control system, access control method, electronic device and control program |
JP5460133B2 (en) * | 2009-06-09 | 2014-04-02 | ラピスセミコンダクタ株式会社 | Microcontroller device |
EP2494488B1 (en) * | 2009-10-15 | 2019-04-24 | TTTech Computertechnik AG | Method for executing security-relevant and non-security-relevant software components on a hardware platform |
US9108823B2 (en) | 2010-03-12 | 2015-08-18 | Mitsubishi Electric Corporation | Elevator safety control device |
US8572345B2 (en) * | 2011-09-16 | 2013-10-29 | Freescale Semiconductor, Inc. | Memory management unit (MMU) having region descriptor globalization controls and method of operation |
JP5975811B2 (en) * | 2012-09-12 | 2016-08-23 | レノボ・エンタープライズ・ソリューションズ(シンガポール)プライベート・リミテッド | Integrity check of measured signal trace data |
JP5842833B2 (en) * | 2013-01-17 | 2016-01-13 | トヨタ自動車株式会社 | Information processing apparatus and program |
US10764129B2 (en) * | 2017-04-18 | 2020-09-01 | Amazon Technologies, Inc. | Logic repository service supporting adaptable host logic |
KR102120044B1 (en) * | 2017-11-28 | 2020-06-09 | 현대오트론 주식회사 | Controller comprising plurality of software levels and operating method thereof |
JP7050587B2 (en) * | 2018-06-11 | 2022-04-08 | 三菱電機株式会社 | Violation dependency detector and violation dependency detector |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US3803559A (en) * | 1971-07-26 | 1974-04-09 | Hitachi Ltd | Memory protection system |
US4442484A (en) * | 1980-10-14 | 1984-04-10 | Intel Corporation | Microprocessor memory management and protection mechanism |
US5452431A (en) * | 1991-10-30 | 1995-09-19 | U.S. Philips Corporation | Microcircuit for a chip card comprising a protected programmable memory |
US5600818A (en) * | 1991-05-08 | 1997-02-04 | Gao Gesellschaft Fuer Automation Und Organisation | Data protective microprocessor circuit for portable data carriers, for example credit cards |
US5987557A (en) * | 1997-06-19 | 1999-11-16 | Sun Microsystems, Inc. | Method and apparatus for implementing hardware protection domains in a system with no memory management unit (MMU) |
Family Cites Families (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4519032A (en) * | 1982-06-09 | 1985-05-21 | At&T Bell Laboratories | Memory management arrangement for microprocessor systems |
US4729094A (en) * | 1983-04-18 | 1988-03-01 | Motorola, Inc. | Method and apparatus for coordinating execution of an instruction by a coprocessor |
US4890223A (en) * | 1986-01-15 | 1989-12-26 | Motorola, Inc. | Paged memory management unit which evaluates access permissions when creating translator |
JPS63250753A (en) * | 1987-04-07 | 1988-10-18 | Fujitsu Ltd | Memory access checking system |
US4985825A (en) * | 1989-02-03 | 1991-01-15 | Digital Equipment Corporation | System for delaying processing of memory access exceptions until the execution stage of an instruction pipeline of a virtual memory system based digital computer |
EP0481735A3 (en) * | 1990-10-19 | 1993-01-13 | Array Technology Corporation | Address protection circuit |
US5557771A (en) * | 1990-12-01 | 1996-09-17 | Hitachi, Ltd. | Data processing system and storage device and auxiliary memory bits for controlling data protection in the storage device |
US5627987A (en) * | 1991-11-29 | 1997-05-06 | Kabushiki Kaisha Toshiba | Memory management and protection system for virtual memory in computer system |
US6151618A (en) * | 1995-12-04 | 2000-11-21 | Microsoft Corporation | Safe general purpose virtual machine computing system |
JPH11120300A (en) * | 1997-10-09 | 1999-04-30 | Fujitsu Ltd | Portable card medium, memory space managing method for portable card medium, issuing method for portable card medium, program data writing method for portable card medium, and medium on which memory space managing program is recorded |
-
2000
- 2000-06-29 JP JP2000196621A patent/JP4522548B2/en not_active Expired - Fee Related
- 2000-12-20 US US09/739,885 patent/US7039779B2/en not_active Expired - Fee Related
-
2001
- 2001-03-09 EP EP01400619A patent/EP1132801A3/en not_active Withdrawn
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US3803559A (en) * | 1971-07-26 | 1974-04-09 | Hitachi Ltd | Memory protection system |
US4442484A (en) * | 1980-10-14 | 1984-04-10 | Intel Corporation | Microprocessor memory management and protection mechanism |
US5600818A (en) * | 1991-05-08 | 1997-02-04 | Gao Gesellschaft Fuer Automation Und Organisation | Data protective microprocessor circuit for portable data carriers, for example credit cards |
US5452431A (en) * | 1991-10-30 | 1995-09-19 | U.S. Philips Corporation | Microcircuit for a chip card comprising a protected programmable memory |
US5987557A (en) * | 1997-06-19 | 1999-11-16 | Sun Microsystems, Inc. | Method and apparatus for implementing hardware protection domains in a system with no memory management unit (MMU) |
Cited By (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1311134A3 (en) * | 2001-11-08 | 2003-11-05 | Nec Corporation | Program executing method in service system and program executing apparatus for the same |
EP1311134A2 (en) * | 2001-11-08 | 2003-05-14 | Nec Corporation | Program executing method in service system and program executing apparatus for the same |
US7228435B2 (en) | 2001-11-08 | 2007-06-05 | Nec Corporation | Program executing method in service system and program executing apparatus for the same |
DE10297687B4 (en) * | 2002-03-27 | 2008-11-13 | Advanced Micro Devices, Inc., Sunnyvale | A processor with partitioned security input / output permission bit structures and methods for selectively executing an input / output instruction |
WO2004090731A2 (en) * | 2003-04-04 | 2004-10-21 | Infineon Technologies Ag | Program-controlled unit |
WO2004090731A3 (en) * | 2003-04-04 | 2004-12-23 | Infineon Technologies Ag | Program-controlled unit |
US8132262B2 (en) | 2005-09-15 | 2012-03-06 | Ntt Docomo, Inc. | External memory management apparatus and external memory management method |
EP1764721A3 (en) * | 2005-09-15 | 2007-12-05 | NTT DoCoMo INC. | Apparatus and method for controlling access to an external memory |
EP1764721A2 (en) * | 2005-09-15 | 2007-03-21 | NTT DoCoMo INC. | Apparatus and method for controlling access to an external memory |
US8316017B2 (en) | 2006-02-09 | 2012-11-20 | Atmel Corporation | Apparatus and method for the detection of and recovery from inappropriate bus access in microcontroller circuits |
FR2897175A1 (en) * | 2006-02-09 | 2007-08-10 | Atmel Corp | Computer system`s resource e.g. register, access detecting module, has detection circuit that detects inappropriate access to computer system during processing activity, and trigger coupled to detection circuit |
US7769964B2 (en) | 2006-08-21 | 2010-08-03 | Intel Corporation | Technique to perform memory reference filtering |
GB2441216A (en) * | 2006-08-21 | 2008-02-27 | Chris J Newburn | Monitoring accesses to a region of memory |
GB2441216B (en) * | 2006-08-21 | 2009-08-26 | Chris J Newburn | Data processing system for monitoring accesses to memory |
EP1942417A1 (en) * | 2006-12-20 | 2008-07-09 | St Microelectronics S.A. | Circuit for protection of memory zones |
EP1939753A1 (en) * | 2006-12-20 | 2008-07-02 | St Microelectronics S.A. | Protection of memory zones |
WO2009018483A1 (en) * | 2007-07-31 | 2009-02-05 | Viasat, Inc. | Input output access controller |
US8312292B2 (en) | 2007-07-31 | 2012-11-13 | Viasat, Inc. | Input output access controller |
US8392983B2 (en) | 2007-07-31 | 2013-03-05 | Viasat, Inc. | Trusted labeler |
EP2851804A1 (en) * | 2013-09-20 | 2015-03-25 | Fujitsu Limited | Arithmetic processing device, information processing device, control method for information processing device, and control program for information processing device |
US9442836B2 (en) | 2013-09-20 | 2016-09-13 | Fujitsu Limited | Arithmetic processing device, information processing device, control method for information processing device, and control program for information processing device |
Also Published As
Publication number | Publication date |
---|---|
EP1132801A3 (en) | 2005-06-29 |
JP2001325150A (en) | 2001-11-22 |
JP4522548B2 (en) | 2010-08-11 |
US7039779B2 (en) | 2006-05-02 |
US20010021966A1 (en) | 2001-09-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP1132801A2 (en) | Access monitor and access monitoring method | |
US6535976B1 (en) | Initial program load in data processing network | |
US5748940A (en) | Secure updating of non-volatile memory | |
US20060184794A1 (en) | Method and apparatus for controlling operating system access to configuration settings | |
US9946600B2 (en) | Method of detecting power reset of a server, a baseboard management controller, and a server | |
US7818625B2 (en) | Techniques for performing memory diagnostics | |
KR100316981B1 (en) | Microcomputer provided with flash memory and method of storing program into flash memory | |
US20050289357A1 (en) | Apparatus and method for securely and conveniently rebooting a computer system | |
JPH07230380A (en) | Method and system for controlling utilization of application program | |
UA55438C2 (en) | Method for checking performance of a specified sequence of software programs | |
CN105637521B (en) | Data processing method and intelligent terminal | |
US7281163B2 (en) | Management device configured to perform a data dump | |
CN114721493B (en) | Chip starting method, computer equipment and readable storage medium | |
US6697971B1 (en) | System and method for detecting attempts to access data residing outside of allocated memory | |
JP2010033576A (en) | Electronic device and method for updating bios | |
US9542113B2 (en) | Apparatuses for securing program code stored in a non-volatile memory | |
US7418542B2 (en) | Rewritable, nonvolatile memory, electronic device, method of rewriting rewritable, nonvolatile memory, and storage medium having stored thereon rewrite program | |
US10895865B2 (en) | Numerical controller | |
JP2005316599A (en) | Interrupt controller | |
US11150884B1 (en) | Device driver update images | |
KR20100006742A (en) | Computer system and control method thereof | |
KR100996167B1 (en) | method for programming memory of electronic control unit | |
US20050027954A1 (en) | Method and apparatus to support the maintenance and reduction of FLASH utilization as it pertains to unused or infrequently referenced FLASH data | |
US20010049794A1 (en) | Write protection software for programmable chip | |
JP2002538532A (en) | Access protection device for IC card applications |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
AK | Designated contracting states |
Kind code of ref document: A2 Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR |
|
AX | Request for extension of the european patent |
Free format text: AL;LT;LV;MK;RO;SI |
|
PUAL | Search report despatched |
Free format text: ORIGINAL CODE: 0009013 |
|
AK | Designated contracting states |
Kind code of ref document: A3 Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR |
|
AX | Request for extension of the european patent |
Extension state: AL LT LV MK RO SI |
|
17P | Request for examination filed |
Effective date: 20050602 |
|
AKX | Designation fees paid |
Designated state(s): DE FR GB |
|
17Q | First examination report despatched |
Effective date: 20060221 |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: G06F 21/02 20060101AFI20090612BHEP |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20091107 |